Predrag Damnjanovic
26/01/05, 21:45
--Message-Boundary-5443
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
After discovering 'highlight' vulnerability in phpBB, many forums
were patched, but... it is possible that attackers created a [secret]
admin accounts...
It is very hard to find secret admin accounts if the forum has too
many users... you must check every account...
So, here is a simple PHP script, that will show a list of all admin
accounts on your phpBB forum.
Just simply copy this file to phpBB directory...
After you find a attacker admin accounts, and remove admin status
from those accounts, you can delete this script, and of course, you
should upgrade your phpBB to the latest version.
A demonstration of this script can be found at
http://www.mycity.co.yu/phpbb/admin_list.php
Best regards,
Predrag Damnjanovic
http://www.mycity.co.yu/
--Message-Boundary-5443
Content-type: Application/Octet-stream; name="admin_list.php"; type=Text
Content-disposition: attachment; filename="admin_list.php"
<?
// Copy this file to phpBB directory (where is config.php file)
// Author: Predrag Damnjanovic Email: peca@mycity.co.yu Homepage: http://www.mycity.co.yu/
define('IN_PHPBB', true);
$phpbb_root_path = './';
include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx);
// Start session management
$userdata = session_pagestart($user_ip, PAGE_INDEX);
init_userprefs($userdata);
// if you want that only admin can open this script
// if (isset($userdata['user_id'])==FALSE || intval($userdata['user_id'])==-1 || intval($userdata['user_level'])!=1) exit;
echo "<html><body bgcolor=\"#E5E5E5\">List of admin accounts :<br>";
$result = mysql_query ("SELECT username from phpbb_users where user_level=1;");
if (mysql_errno()>0) die (mysql_error());
while ($row = mysql_fetch_array($result, MYSQL_ASSOC))
echo "<b>".$row['username']."</b><br/>\n";
mysql_free_result($result);
echo "</body></html>";
?>
--Message-Boundary-5443--
Content-type: text/plain; charset=US-ASCII
Content-transfer-encoding: 7BIT
Content-description: Mail message body
After discovering 'highlight' vulnerability in phpBB, many forums
were patched, but... it is possible that attackers created a [secret]
admin accounts...
It is very hard to find secret admin accounts if the forum has too
many users... you must check every account...
So, here is a simple PHP script, that will show a list of all admin
accounts on your phpBB forum.
Just simply copy this file to phpBB directory...
After you find a attacker admin accounts, and remove admin status
from those accounts, you can delete this script, and of course, you
should upgrade your phpBB to the latest version.
A demonstration of this script can be found at
http://www.mycity.co.yu/phpbb/admin_list.php
Best regards,
Predrag Damnjanovic
http://www.mycity.co.yu/
--Message-Boundary-5443
Content-type: Application/Octet-stream; name="admin_list.php"; type=Text
Content-disposition: attachment; filename="admin_list.php"
<?
// Copy this file to phpBB directory (where is config.php file)
// Author: Predrag Damnjanovic Email: peca@mycity.co.yu Homepage: http://www.mycity.co.yu/
define('IN_PHPBB', true);
$phpbb_root_path = './';
include($phpbb_root_path . 'extension.inc');
include($phpbb_root_path . 'common.'.$phpEx);
// Start session management
$userdata = session_pagestart($user_ip, PAGE_INDEX);
init_userprefs($userdata);
// if you want that only admin can open this script
// if (isset($userdata['user_id'])==FALSE || intval($userdata['user_id'])==-1 || intval($userdata['user_level'])!=1) exit;
echo "<html><body bgcolor=\"#E5E5E5\">List of admin accounts :<br>";
$result = mysql_query ("SELECT username from phpbb_users where user_level=1;");
if (mysql_errno()>0) die (mysql_error());
while ($row = mysql_fetch_array($result, MYSQL_ASSOC))
echo "<b>".$row['username']."</b><br/>\n";
mysql_free_result($result);
echo "</body></html>";
?>
--Message-Boundary-5443--